WO2003007132A1

WO2003007132A1 - Data-protected memory device for a processor

Info

Publication number: WO2003007132A1
Application number: PCT/EP2002/007548
Authority: WO
Inventors: Peter MÖLLER; Zoran Mijovic; Manfred JÜNKE; Joachim Ritter; Steffen Zimmermann
Original assignee: Micronas Gmbh
Priority date: 2001-07-10
Filing date: 2002-07-06
Publication date: 2003-01-23
Also published as: KR100906175B1; US20030014653A1; JP2003044363A; EP1276033B1; KR20030029970A; EP1276033A1; US7761717B2; CN1215390C; CN1465002A

Abstract

The invention relates to a memory device (1) for a processor (10) that is monolithically integrated therewith and that contains a first and a second memory part (2 and 3, respectively) for an initialing program and for a user program, respectively. The first memory part (2) is readable and/or writeable via a first group of data interfaces (16, 18) and the second memory part (3) via a second group (16, 17, 18). The first and/or second memory part (3) contains memory blocks (4, 5, 6, 7) that can be addressed block by block. A first memory block (4) contains a protection register (PCR) with programmable release or blocking information for the individual data interfaces. The protective register (PCR) is inquired once power is switched on. A second and a third memory block (5 and 6, respectively) are used for storing a password (key 1, key 1*) that is coupled to an encryption and identification program in the memory device (1).

Description

Storage device with data protection in a processor

The invention relates to a memory device with data protection in a processor. The invention supports the protective function of known encryption methods with public or secret key or passwords by preventing access to both the encryption program and the password in the respective storage device. These sensitive data are located on a read / write memory integrated in the processor, for example an electrically writable and readable "flash" memory. This has the advantage that the content of the read / write memory cannot be read out directly, but only indirectly via data interfaces The standardized interfaces are, for example, the externally accessible data interfaces

JTAG (= Joint Test Action Group), UART (= Universal Asynchronous Receiver Transmitter) or USB (= Universal Serial Bus Interface) are known, which enable serial access. In some cases, as with USB, the interface function must be supported by special programs in the processor, in some cases the interfaces are controlled purely externally and are completely independent of the processor. Parallel and therefore very quick accesses may be via others

Data interfaces possible, which can also be dependent on the processor or independent, standardized or non-standardized. For such parallel interfaces, the function of a multiplicity of connections is generally switched over, so that, for example, data and addresses with 32 bits each can be input in parallel or output in parallel.

If the user or a third party wants to gain knowledge of an encryption process without authorization, this usually serves to ultimately access the content of encrypted data. This can be stored or transmitted data. An example of this is the unauthorized transmission and duplication of music pieces subject to a fee using the MP3 compression process. This can be prevented by encrypting the data, but the individual or global encryption program must remain secret. If you are very interested in decryption, it can be assumed that bypass programs will be spread quickly via the Internet or other means and will make encryption ineffective.

It is the object of the invention to provide protection for stored data of a processor, which are stored there in connection with an encryption or decryption program. In particular, the encryption or decryption program is to be protected against unauthorized reading, modification or deletion. For authorized users, however, one should Program updates can be made at any time. The level of protection should be specifiable, in particular, by the user and not by the processor manufacturer. In the following text, encryption and decryption are usually summarized as "encryption" to simplify the language.

In the following, the term user is understood to mean the person who buys the processor as a component from the semiconductor manufacturer and installs it in an application circuit in order to produce a device or a device. The device or device is ultimately purchased and commissioned by a user directly or as part of another device or device.

This object is achieved by the features claimed in claim 1. Advantageous further developments and refinements can be found in the dependent claims.

The basic idea of the invention is that the memory device to be protected is integrated in a processor and contains a first and a second memory part with different access options. The integration of the storage device enables a combination of hardware and software protection measures that are not possible with a separate storage device. The first memory part receives an initialization program, which also serves as a boot program for decryption, and the second memory part an application program, for example a program for decrypting and / or decoding received data. Such data can be audio data, for example, which are encoded according to the MP3 standard and additionally encrypted against unauthorized reception with a secret or public password. This decryption program can be identical to the fairly secure decryption program in the boot area or is part of the application program in the second memory part.

The first memory part can be programmed and changed via one or more external data interfaces, but not via the processor or a data interface controlled by it. This can prevent the processor from being brought to the content of the initialization program via at least one program, which contains at least part of the encryption,

Decryption or identification program contains, read out, change or destroy. The basic function in the first memory section is then always sufficient to reload the faulty application program in the second memory section. The second memory section is both about the external data interfaces as well as programmable and changeable via the processor and the data interfaces controlled by it.

The non-lockable access of the processor to the first and second memory part is necessary both during normal operation and when the user provides program updates by authorized users. Such program updates are required, for example, at predefinable intervals for changing the individual or group-specific encryption program or password in order to limit the negative consequences of accidental or illegal disclosure of the encryption. A lock that does not include program updates is, however, also possible according to the invention in that all external data interfaces, that is to say also those controlled by the processor, are locked by the user by setting a lock information. As already mentioned, the processor always has access to the two memory parts for normal operation.

The invention is very flexible in adapting to the respective protection needs of the user and enables both consumer-related and professional applications. A conceivable consumer application relates, for example, to an encrypted transmission of video or audio data. With the invention, only the authorized licensee can decrypt the data by means of the processor for further processing in the processor and own playback, but he cannot make a copy of the decrypted data for third parties because they are not available at any externally accessible interface. It is similar if the engine in a motor vehicle is controlled via an electronic engine management system whose secret program is to be protected against copying or modification.

The authorization or identity is checked via the protected encryption program, which interacts in a known manner with the public or non-public keyword stored in the first or second storage part and the program received in encrypted form. Only when all parts fit together is it possible to decrypt and thus use the data received or to update the stored program.

The second and possibly also the first memory part is divided into different memory blocks, so that a block-wise change or deletion in the program updates is possible in order to avoid conflicts between the new and old programs. A first memory block in the first or second memory part contains a protective register with programmable release or blocking information for each data interface in order to block or release the reading and / or writing of the first and second memory parts via this data interface. As long as the blocking information is not yet activated, the first and second memory areas are accessible via all external data interfaces, that is to say also those controlled by the processor. This enables, for example, the manufacturer or user to adapt, change or correct the initialization or application program. If after the completion of these changes the blocking information for the externally accessible data interfaces is set by the user, these can generally no longer be removed by anyone without destroying the existing program. The first memory block 4 with the contained therein

Locking information is thus securely secured against any change. Users who identify themselves as authorized via the existing software and the saved password can, if necessary, change the content of the protection register, i.e. remove the block. This option allows the user to troubleshoot the actually locked processor if necessary.

The protection register is expediently queried as soon as the power supply is switched on by means of queries hard-wired in the processor, specifically before the initialization program permits other queries or programming. The hard wiring of these queries, which are so important for protection, has the advantage that they cannot be changed intentionally or accidentally by any program. Of course, this also ensures that the query of the protection register cannot be bypassed even briefly when the network is switched on or when it is interrupted.

A second and a third memory block in the first or second memory part serve the double storage of the public or private keyword. The key word, which is also called

Password is referred to, and is coupled to the encryption program in the first and / or second memory part. Whether the user prefers protection with a publicly accessible or with a publicly inaccessible, that is to say a private or secret keyword, is immaterial to the invention and only depends on the need for protection. The advantages and disadvantages of both systems are not changed by the invention, but access to the protected data content is prevented in both cases or at least made significantly more difficult.

A fourth, relatively large memory block in the second memory part is used to store an application program. This program is usually updated when the program is updated completely replaced. The content of the application program, in conjunction with the password, enables the processor to decrypt and decode the received data. Protection against unauthorized access can of course not only be used on the decryption side but also on the encryption side.

The invention and advantageous developments will now be explained in more detail with reference to the figures of the drawing:

1 schematically shows the division of a memory unit integrated in the processor, FIG. 2 schematically shows a protective register with memory locations for the interfaces, FIG. 3 schematically shows an initialization process in the flowchart,

Fig. 4 shows schematically in the flow chart a program update and

5 schematically shows a processor as an embodiment of the invention.

1 schematically shows the division of a memory device 1 integrated in the processor 10 (see FIG. 5). A first memory part 2, which begins with the start address 0x00, contains an initialization program that is also referred to as a boot program. This first memory part 2 has only limited access options for programming for the user and manufacturer, namely only via those data interfaces which are dependent on the function of the sensor. During the manufacturing process, easier access to the first memory area may be possible via chip contacts that are no longer available later in order to load the initialization program.

The initialization program is activated when the processor is switched on. It also contains programs that check the authenticity or identity of the user or user and also support reading and writing of the data interfaces controlled by the processor. The

Initialization program also contains at least those parts of the decryption program that are required in order to be able to reprogram an empty or faulty second memory part with the support of the processor, for example by feeding the encrypted new program via a data interface controlled by the processor.

The first memory part 2 is followed by the second memory part 3 (= user area) with the application program, the addresses of which are divided in blocks and begin with the user start address adr-U. The first memory block 4 contains a protection register PCR (= Protection Control Register) with the release or lock information for the individual data interfaces. Additional space for further data is available in the first memory block 4.

The second and third memory blocks 5 and 6, which essentially contain the password “key 1” or “key 1 *” assigned to the user or the user group, are connected to the first memory block 4. Both passwords are identical to each other and must be available in separately erasable memory areas so that at least a valid password is always available when reprogramming. Without this password, the received data cannot be decrypted. So that the existing password can be replaced by a new password when reprogramming, the existing password becomes different

Program sections in the second and third memory blocks 5 and 6 exchanged for the new password. The second and third memory blocks 5, 6 are large enough so that they can, if necessary, include further passwords for other encryption programs.

The actual application program is located in a fourth memory block 7. This

Memory block is large enough to hold current and future user programs. The different access control or ultimately the desired blocking of the first and second memory parts 2 and 3 is controlled by hardware using the block addresses. For example, the programming signal of the processor is logically linked to the area signal for the first memory part 2, so that the global or block memory signal for the

Storage device 1 is not formed at all. However, if the first memory part 2 is addressed in connection with a data interface that is independent of the processor, the global or block memory signal is not suppressed, unless the associated blocking signal is set in the PCR register. Similarly, by linking the block addresses or address area signals with signals for reading or writing the memory device 1 and the associated data interface, the blocks 4 to 7 in the second memory part 3 are controlled.

In the exemplary embodiment in FIG. 1, the memory blocks 4, 5, 6 are assigned to the second memory part 3. This provides the greatest flexibility for the protective device because it is possible to change the access authorization and password via reprogramming (= update). However, if the protective register PCR or registers 5, 6 for the password Key 1, Key 1 * are in the first memory section 2, then reprogramming via the processor is not possible and access authorization and the password are permanently determined by the existing programming. Protection against unauthorized access remains unaffected, because the electronic blocking of the externally accessible data interfaces does not allow data to be read out.

FIG. 2 schematically shows the protective register PCR in the first memory block 4. For each external data interface, the protective register contains a memory location for holding a "1" or "0" value. The content "1" means that reading or writing of the memory device 1 is possible via the associated data interface. Of course, this release does not override the specified access options, for example that the first memory part 2 is never accessible via data interfaces controllable by the processor The choice of "1" depends on the respective technology of the memory device 1. In flash memories, all cells are in the "1" state after deletion, so the logical state "1" must be selected as the enable signal for this type of memory. Accordingly, "0" then represents the blocking signal for the read, write and erase process. At the start of operation, each position of the register content sets a corresponding "1" or "0" state in a state machine of the processor when the power is switched on Or the PCR register already serves as such a status register via fixed readout lines. The content of such a status register may only be changed during operation either by changing the protective register content or by switching off the network. A change in the status register content when switched on depends on PCR registers only possible from state "1" to state "0". Changes in the other direction are not possible because the blocking signal "0" blocks access to the protective register PCR via the externally accessible data interface.

3 shows in the flowchart the process steps taking place when the supply voltage is switched on. Switching on the supply voltage (= power on) immediately triggers a query of the individual memory locations in the protective register PCR. In the assumed example of an integrated flash memory, the logical state "1" corresponds to the enable (= enable) and the state "0" corresponds to the disable (= disable). 3 shows three externally accessible data interfaces as examples: a JT AG interface, a parallel interface and a TEST interface. If the corresponding interface is enabled, which is symbolized by a respective function box, data of the memory device 1 can be read out or changed via this interface. The end of this reading or writing is formed by triggering the jump to the start address 0x00 in the boot area. If, however, lock information is read from the PCR register after switching on, the jump to the boot start address 0x00 and a reading or writing of any part of the Storage device 1 via the interfaces is not possible. The lock information of the PCR register cannot be undercut in this way, because this hardware-controlled query takes place as the first step immediately when the supply voltage is switched on during the first system clock cycles. In contrast, starting the program from the boot memory address 0x00 represents pure software operation.

Starting the program from the boot start address 0x00 triggers a query as to whether a new application program - e.g. an “update” should be loaded. This input request can be signaled, for example, by manually actuating an input key (= update key). If this is desired (= key set), a programming mode is triggered, which is explained in more detail in the flow chart of FIG. 4 becomes.

If no program update is desired, a check is then carried out as a further step as to whether a complete and valid (= valid) application program (= USER program) is located in the second memory part 3. Is the test result negative because that

Application program is not complete, a wait state is triggered and the running functions are interrupted. However, if the application program is complete and valid, a jump to the program start address adr-U of the application program is triggered. The first memory part 2 with the initialization program (= boot program) is thus left. The processor 10 (cf. FIG. 5) is now ready, according to the existing application program, to decrypt, decode and further process the content of the received data internally. As already mentioned, the decrypted data cannot be passed on via externally accessible interfaces.

A further safeguard against unintentional deletion of the entire memory device 1 is possible by inserting a programmable protection bit (= set protection bit) in the “no” branch after the input key query (= update key). This protection bit can be set when the application program is being programmed and then prevents, by means of circuit measures, that the memory device 1 is wholly or partly deleted by any accidental disturbance in a program that is currently running can only be avoided if the device is switched off and the input of a new application program is signaled by means of the enter key Protection bit is set or not, is at the discretion of the user who creates and makes the new application program available.

4 shows in the flowchart the sequence of reprogramming (= update) of the application program, which is triggered by the programming mode. First, an identification check is carried out. If this test is negative, the programming mode is interrupted immediately and a waiting state is initiated and displayed. If the identification check was successful, the next step is to delete the second circuit block 4 with the key word "Key 1". Then a query is made as to whether the existing property right register PCR contains blocking information (= "0") and whether the new content also contains blocking information is. If neither is fulfilled, the PCR register is deleted. This query, which at first glance seems a little strange, has the following purpose. First of all, the cases are determined in which the content of the protective register PCR has to be changed or the release status is to be maintained. In these cases, the PCR content can first be deleted before the content of the new program is loaded. However, if this check reveals that the previous content of the protection register was lock information and that the program to be reloaded also contains lock information, then the protection register PCR is not deleted. This ensures that the blocking information contained in the protection register is never interrupted during reprogramming, and therefore not briefly. After the protective register PCR has its new content, the further application program can be in the fourth

Circuit block 7 are loaded. The loading is expediently preceded by a deletion of the old application program.

It is pointed out that the password "Key 1 *" was deleted in the third memory block 6 during the entire programming of the application program. The decryption of the

The program was carried out using the password “Key 1” present in the second memory block 5. After the new program is loaded in the fourth memory block 7, the new password “Key 1 *” is written into the third memory block 6 by the received program. As the last step of the reprogramming, the old password "Key 1" in the second memory block 5 is deleted and replaced by the new password. The reprogramming is thus completed.

The flowchart shows that the reprogramming begins with the deletion of the password in the third memory block 6 and ends with the deletion and writing of the new password in the second memory block 5. The state of the third and second memory blocks 6 and 5, respectively thus a statement as to whether the programming of the application program is complete or whether the program was terminated before completion. If an incomplete application program is present, then a simple identity comparison of the contents of the second and third memory blocks 5, 6 shows whether the application program is complete and thus valid. If the application program is invalid, the processor falls into a wait mode according to FIG. 3, which can only be ended by starting a new program from the user start address adr-U.

A global deletion of the entire contents of the storage device 1 is not shown in the flowcharts of FIGS. 3 and 4. It can be triggered, for example, by a predefined configuration of levels at predefined connections of the processor 10. This condition must never occur even in the worst case of the processor. It is therefore expedient for the global deletion to be linked to a completely irregular operating state. The global erasure has the purpose, under certain conditions, of unlocking the protective register PCR without any protected data being able to be read from the memory device. Because of the deletion, this data has disappeared. Reprogramming of the entire memory device 1 is now possible. Programming is a bit difficult because the first memory section can still not be loaded via data interfaces controlled by the processor, but only via the interfaces independent of the processor. The global deletion enables the manufacturer or user to still use processors loaded with a faulty or incorrect program after they have been blocked. Information about the memory contents is not possible for Ditten, provided that they are aware of the global deletion. The protective function is therefore fully preserved.

5 shows schematically as a block diagram an embodiment of the invention with the functional units important for the protective function. A processor 10 contains a processor core 11, the inputs and outputs of which are connected to an internal data bus 12 and an internal address bus 13. Since these two buses 12, 13 are not routed to the outside, they can also be designed as fast parallel buses with, for example, 32 lines each. There may also be less effective bus connections internally that connect the individual functional units of the processor. The entire processor 10 is clocked with a system clock cl, which is generated in an integrated clock generator 14. The data and addresses to be processed in the processor core 11 come either via a data bus 12 or an address bus 13 from a static random access memory (= SRAM), a flash memory 1 or a data interface 16, 17, 18. It is also possible that the data and addresses are fed directly from a data interface 16 to the processor core. 5, the following externally accessible data interfaces are connected to the data and address bus 12 and 13: a JTAG interface 16, a USB interface 17 and a parallel interface 18. The USB data interface 17 works with the processor core 11 via an appropriate program control. The interfaces JTAG 16 and the parallel interface 18, which are independent of the processor core 11, have more or less convenient data and address inputs.

To form memory area signals adr-i, memory area signals adr-i are formed from the individual addresses by means of an address generator 19. These address area signals are linked for each data interface 16, 17, 18 in an associated link device 20, 21, 22 with the associated lock or release signal from the PCR register and form an associated control signal 25, 26, 27 that the respective interface 16, 17 , 18 blocks or releases.

Claims

claims

1. Storage device (1) for a processor (10), which is monolithically integrated with this and a first storage part (2), e.g. for an initialization and / or boot

Program, and a second memory part (3), e.g. for an application program that contains

the first memory part (2) can be written and / or read via a first group of data interfaces (16, 18) and the second memory part (3) via a second group of data interfaces (16, 17, 18),

- The first and / or second memory part (2 or 3) contain block-by-block addressable memory blocks (4, 5, 6, 7),

a first memory block (4) contains a protective register (PCR) with programmable release and / or lock information for the first and second group of data interfaces (16, 18; 16, 17, 18),

- The protection register (PCR) is queried before the initialization program permits queries or programming.

2. Storage device according to claim 1, characterized in that the first group of data interfaces from the processor (10) comprises independent data interfaces (16, 18).

3. Storage device (1) according to claim 1, characterized in that the second group of data interfaces comprises both the data interfaces (16, 18) and the processor (10) controlled data interfaces (17) which are independent of the processor (10).

4. Storage device (1) according to one of claims 1 to 3, characterized in that a second and a third memory block (5 and 6) of storing a password (key 1, key

1 *) serve, which is coupled with a decryption and / or encryption program in the first and / or second memory part (2 or 3).

5. Storage device (1) according to claim 4, characterized in that only for an authorized access, which by means of the password (key 1, key 1 *) and the initialization contained in the first and / or second memory part (2 or 3) , Decryption and / or encryption program is identified, a writing and / or reading of the second memory part (3), for example as part of a program update, via the second group of data interfaces (16, 17, 18) is possible, provided that no associated blocking information is set in the protection register (PCR).

6. Storage device (1) according to claim 5, characterized in that the writing and / or reading of the first storage part (2) with a blocking information set in the protection register (PCR) even with an authorized access via the first group of data interfaces (16, 18th ) not possible.

7. Memory device (1) according to one of claims 1 to 6, characterized in that in the event of a program or supply voltage interruption in which at least part of the application program in the second memory part (3) is changed or deleted, the processor (10) in passes a wait state.

8. Storage device (1) according to claim 7, characterized in that the waiting state is ended by start information which triggers a reprogramming of the application program (USER program) starting from a start address (adr-U).

9. Memory device (1) according to one of claims 1 to 8, characterized in that the first and second memory areas (2, 3) can be erased by means of global erasure information.

10. Storage device (1) according to claim 9, characterized in that the global erase information can be triggered by means of a predetermined configuration of levels at predetermined connections of the processor (10).

11. Memory device (1) according to claim 10, characterized in that the predetermined connections in the installed operating state of the processor (10), in particular via a built-in board, are not accessible.

12. Storage device (1) according to one of claims 1 to 11, characterized in that when the program is updated, the blocking information already present in the protection register (PCR) is not deleted at any time interval, but remains unchanged in the protection register when the new program is likewise for the respective one data interface

(16, 17, 18) has blocking information.

13. Storage device (1) according to one of claims 1 to 12, characterized in that the blocking of the associated data interfaces (16, 17, 18) triggered by the query of the protective register in the initialization program takes place via internal control signals (25, 26, 27), that cannot be canceled directly, indirectly or through a program.

14. Memory device (1) according to one of claims 1 to 13, characterized in that a programmable protection bit (set protection bit) is inserted into the application program, which prevents circuitry from accidentally deleting the memory device (1).